T03 · Remote Payload Retrieval and Execution
Error
- Location
realtime_asr.py:186- Finding
Unpinned Third-Party Model Code Is Trusted and Executed
- Content
View full analysis
- Remediation
View remediation
Security audit
realtime-transcription
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to provide the advertised transcription workflow, but it records and stores sensitive audio-derived text while relying on broad permissions and unpinned executable dependencies/model code.
Review before installing. Only use this skill where recording microphone or system audio is appropriate and consented to, avoid sensitive meetings or private media, and expect transcripts plus summaries to be saved locally. Prefer a dedicated virtual environment, pinned dependency versions, and a pinned or verified model that does not require trust_remote_code before running it.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
T08 · Insecure Dependencies
Warning
- Location
realtime_asr.py:21- Finding
Unpinned Python Dependencies Are Installed into the Active Environment
- Content
View full analysis
- Remediation
View remediation
T01 · Skill Instruction Hijacking
Warning
- Location
summary_prompt.py:30- Finding
Audio Transcript Content Can Inject Instructions into the Summarization Prompt
- Content
View full analysis
str: """ Build the summary prompt, truncating the transcript if it exceeds max_chars to avoid overwhelming the LLM context. """ if len(transcript_text) > max_chars: # Keep the beginning and end (most important parts) half = max_chars // 2 truncated = transcript_text[:half] + "\n\n... [truncated] ...\n\n" + transcript_text[-half:] else: truncated = transcript_text return SYSTEM_PROMPT + "\n\n--- Transcript ---\n\n" + truncated ``` ### Technical Analysis The transcript is attacker-influenceable data derived from microphone or system audio. It is appended directly to the instruction prompt as plain text. The prompt does not explicitly state that instructions found inside the transcript are untrusted quoted data and must never be followed. An attacker whose speech is captured can introduce instruction-like content such as requests to ignore previous directions, alter the title, omit facts, or emit crafted Markdown and YAML. Because instructions and transcript data share the same prompt string, the language model may interpret transcript content as higher-level operational instructions instead of content to summarize. The transcript is truncated by retaining its beginning and end. An attacker can improve the likelihood of injection survival by placing malicious instructions near either retained boundary. ### Attack Path 1. An attacker speaks near the microphone or plays audio through the captured system-audio source. 2. The ASR engine converts the spoken instruction into transcript text. 3. `build_summary_prompt` appends that text directly to the summarization prompt. 4. The active LLM interprets the transcript ...[truncated 858 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
archiver.py:52- Finding
Unescaped LLM and Transcript Content Can Inject YAML and Markdown
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
skill.yaml:35- Finding
Stop Command Trusts an Unvalidated Mutable PID File
- Content
View full analysis
/dev/null) 2>/dev/null; rm -f .tmp/asr.pid" ``` ### Technical Analysis The stop command reads shell arguments from `.tmp/asr.pid` and passes them directly to `kill`. It does not validate that the file contains exactly one positive decimal process ID, verify ownership of the process, or confirm that the target process is the expected transcription process. Because shell command substitution performs word splitting, a modified PID file can supply multiple arguments or option-like values. For example, a negative process identifier can target a process group, and some platform-specific values may target a broader set of processes. Even a valid positive PID may refer to an unrelated process if the transcription process ended and its PID was subsequently reused. The PID file is created with default permission behavior under a relative runtime directory. The code does not enforce restrictive directory or file permissions or atomic exclusive creation. ### Attack Path 1. A local attacker or another process with write access to the project runtime directory modifies `.tmp/asr.pid`. 2. The attacker writes an unrelated PID, multiple PIDs, or a dangerous option-like or negative value. 3. The user asks the Agent to stop transcription. 4. The configured shell command expands the PID-file contents as arguments to `kill`. 5. `kill` sends a termination signal to processes other than the intended transcription process. 6. The command removes the PID file, reducing evidence and preventing straightforward process-identity verification after the action. A race is also possible if the original process exits and its PID is reused before the stop command runs. ### Impact Assessment An attacker c ...[truncated 447 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (21)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill records microphone or system audio and archives transcripts, but the description does not provide a clear privacy warning or consent expectations. This increases the risk of users enabling capture without understanding that sensitive speech or system audio may be transcribed, summarized, and stored on disk.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Press
Ctrl+Cin the terminal, or:bash kill $(cat .tmp/asr.pid 2>/dev/null) 2>/dev/null; rm -f .tmp/asr.pidAfter Stopping — Summary & Archive
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
yaml check_deps: "python3 realtime_asr.py --check-deps" start_blackhole: "python3 realtime_asr.py --source blackhole --output .tmp/transcript.txt --state .tmp/asr.pid" start_mic: "python3 realtime_asr.py --source mic --output .tmp/transcript.txt --state .tmp/asr.pid" stop: "kill $(cat .tmp/asr.pid 2>/dev/null) 2>/dev/null; rm -f .tmp/asr.pid" read_transcript: "cat .tmp/transcript.txt 2>/dev/null || echo 'No transcript available'" paths:
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
md check_deps: "python3 realtime_asr.py --check-deps" start_blackhole: "python3 realtime_asr.py --source blackhole --output .tmp/transcript.txt --state .tmp/asr.pid" start_mic: "python3 realtime_asr.py --source mic --output .tmp/transcript.txt --state .tmp/asr.pid" stop: "kill $(cat .tmp/asr.pid 2>/dev/null) 2>/dev/null; rm -f .tmp/asr.pid" read_transcript: "cat .tmp/transcript.txt 2>/dev/null || echo 'No transcript available'" paths:
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
yaml check_deps: "python3 realtime_asr.py --check-deps" start_blackhole: "python3 realtime_asr.py --source blackhole --output .tmp/transcript.txt --state .tmp/asr.pid" start_mic: "python3 realtime_asr.py --source mic --output .tmp/transcript.txt --state .tmp/asr.pid" stop: "kill $(cat .tmp/asr.pid 2>/dev/null) 2>/dev/null; rm -f .tmp/asr.pid" read_transcript: "cat .tmp/transcript.txt 2>/dev/null || echo 'No transcript available'" paths:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README promotes real-time capture, transcription, summarization, and archival of microphone or system audio, but it does not prominently warn users that sensitive conversations, media, notifications, or third-party audio may be recorded and stored on disk. In this context, the omission can lead to unintended collection and retention of personal or confidential data, especially because the skill supports system-wide audio capture and automatic archiving.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger list in metadata includes a bare stop phrase ("停止" / "stop") without requiring that this skill already be active or that the command be scoped to transcription. In an agent environment, generic stop words are common in unrelated conversations and can unintentionally terminate recording or invoke follow-on logic, making accidental activation plausible.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The workflow directs the operator to read the full transcript, send it to an LLM for summarization, and archive the complete transcript alongside the summary. This creates a natural-language data leakage path because potentially sensitive spoken content is intentionally propagated to additional processing and persistent storage without minimization.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger table explicitly maps a generic "停止" / "stop" utterance to stopping the process, summary generation, and archival. Because the action chain includes handling sensitive transcript data after stopping, an ambiguous phrase can cause unintended workflow execution and privacy-impacting data processing.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This tool captures microphone or system audio and writes transcripts to disk, but the usage/help text does not provide a clear privacy warning about recording sensitive conversations, meetings, credentials spoken aloud, or copyrighted media. In this context, the skill's core purpose is surveillance-adjacent data capture, so lack of explicit notice and consent guidance makes the privacy risk more significant.
- Content
Dynamic import via __import__()
Medium
- Category
- Dangerous Code Execution
- Confidence
- 75% confidence
- Finding
Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.
- Content
python missing = [] for pkg in REQUIRED_DEPS: try: __import__(pkg.replace('-', '_')) except ImportError: missing.append(pkg) return missing
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
A transcription utility does not need to self-install Python packages during normal operation, so this capability is broader than its core purpose. Runtime dependency installation introduces unnecessary supply-chain exposure and can lead to execution of package-provided code if the environment or package source is compromised.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Several printed messages and CLI outputs are hard-coded in Chinese, while the file otherwise uses English descriptions and does not indicate that the skill is intended only for Chinese-speaking users. This creates a language-policy issue because the skill imposes a locale on users without opt-in or justification.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 87% confidence
- Finding
The script can invoke pip at runtime to install packages, which expands its capabilities beyond transcription into code acquisition and execution from package repositories. Even though the package list is hard-coded and subprocess.run is used safely without shell=True, installing and importing packages on demand increases supply-chain risk and can execute untrusted package install-time code.
- Content
python print(f" [{i}/{total}] 安装 {pkg}... {desc}") print(f" ⏳ pip3 install {pkg} ", end="", flush=True) try: result = subprocess.run( [sys.executable, '-m', 'pip', 'install', '--quiet', pkg], capture_output=True, text=True, timeout=300 )
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Executing a subprocess to perform pip installation grants the skill the ability to modify its runtime environment and fetch executable content, which is an elevated action unrelated to live audio transcription. In context, this is not overtly malicious, but it materially increases the attack surface through package supply-chain abuse.
- Content
Unbounded Resource Access
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
- Content
python while not self.stop_event.is_set(): try: chunk = self.audio_queue.get(timeout=0.2) except queue.Empty: continue
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly records audio, summarizes the resulting transcript, and archives it as Markdown, but the manifest does not provide a strong, explicit warning about retention and sensitive data handling. Because the skill can capture microphone or system audio, silent archival materially increases the risk of storing confidential conversations without informed user consent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrase "停止" is extremely broad and can easily appear in ordinary conversation, causing unintended activation of stop behavior. In a transcription skill, accidental stopping can interrupt capture and trigger downstream summarization and archival of sensitive content without a clearly deliberate invocation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The English trigger phrase "transcribe" is too generic to distinguish from normal user requests about transcription. This can cause the skill to activate unexpectedly and begin recording or handling transcript data when the user may have only been asking a question, increasing privacy and consent risks.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 72% confidence
- Finding
The README defines activation phrases in both Chinese and English, but it does not explain whether the skill expects one language, supports both equally, or how language selection is determined. This can create a locale-policy ambiguity because language behavior is prescribed without explicit user choice or opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The generated Markdown content hard-codes Chinese headings ("摘要" and "完整转录") for every archive file. This imposes a specific language choice on users without any visible option, opt-in, or documented reason that the skill is region-specific.
- Content